CVE-2026-92361 Details
Description
A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fix this issue awaits acceptance.
A denial-of-service vulnerability has been identified in the AG-UI Protocol version 1.0, specifically within the SSE Client component. The issue arises in the file 'sdks/community/go/pkg/client/sse/client.go', where an uncontrolled accumulation of incoming event data occurs. This vulnerability allows for remote exploitation, as a misbehaving or malicious agent endpoint can cause unbounded memory growth in the client's process, potentially leading to resource exhaustion.
A pull request has been submitted to address this vulnerability by implementing a memory cap on the SSE client's event handling. This proposed fix is based on the Dart SDK's reference implementation, which enforces a data cap of 8 MiB per event, limits the length of event IDs, and rejects null characters.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ag-ui-protocol/ag-ui/ | [email protected] | Vendor |
| https://github.com/ag-ui-protocol/ag-ui/issues/2438 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/ag-ui-protocol/ag-ui/pull/2700 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-92361 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/934952 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/405447 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/405447/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ag-ui-protocol ag-ui | 1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Translated | [email protected] |
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |